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l It is difficult to comment in depth on all of the concepts in 
the STAP options for SAFE paper within the two days a lowed for review. 
Tte observations that follow are based on a quick review of a paper that 
proposes a major directional change in SAFE system design. OCR s 

that the new approach is superior to the current one. 

Conrninitv SAFE 

2 STAP has characterized SAFE as "a large and intimidating R&D 

effort'" We believe that expansion of the current desl 9\^°"£ n CIA and 

DIA to include the Community at this time would compound this R&D 

challenge and jeopardize eventual success of the system, not only for 

2® 11 tun anpnries but eventually for the Community. The paper as 
those two agencies duc eventual ijr Commun ity involvement now except 

written does not make a strong case Tor o y cntrc occontial 

atlalyltf in C C«itJ-wide W a”ess a aid refriewl ."* P Further, Pointing out 

a need for an ADP-Communi cations Community manager and the nee o 

Ssasw wii ass.5jr?sAg sr 

SSS" 1 ist1 1 c°to SdA"t' no?"bIi SjlartTan overal 1 Community 

archi tecture^hen 1 no such architecture exists dudgin^fro^past^ 

experiences, it would take at least anot , wa ^ t that long for a 

SAFE^system X assistlhern'in improving intelligence, analysis and 
production. 
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3. We believe that the current development approach will provide 
the base for a future Community system. Our experience to date with 

DIA requirements indicate that many are already being met by the require- 
ments previously established by CIA. Since SAFEinvolves basic 
general purpose analytical tools, it is our opinion that a major SAFE 
re -design would not be required to expand the system to the Community* 

The Community needs will be met with the current approach. 

A True Pilot SAFE 

4. The recommendations for a pilot system consisting of an 
improved Interim SAFE fail to take into account the long history of how 
CIA SAFE requirements were originally generated and how they have been 
refined, verified, and amended over the past six years. It is true that 
in a true "engineering" sense the Interim SAFE system is not a true 
operational model of the final system, but Interim SAFE itself evolved 
from an initial pilot system that was designed to determine if analysts 
could use on-line computer services to support their day-to-day opera- 
tions. NFAC analysts became so enthused about the Interim System that 
they convinced the DCI and other senior Agency management of the need 
for SAFE (an interesting human factors experience for management not 
mentioned by STAP). NFAC analysts also convinced management to retain 
and expand the Interim System until full SAFE could be developed. The 
basic requirements for SAFE, at least as far as NFAC analysts are 
concerned, have been verified and expanded by surveys, workshops, direct 
analytical contacts, an extensive SAFE user network, testing and 
evaluation of SAFE concepts in a SAFE test lab, and extensive customer/ 
contractor interaction. DIA SAFE requirements have been folded into 
CIA SAFE'S requirements and DIA is participating in tests in the ->AFE 
test lab. 


5. We do not take issue with the STAP statement that modifications 
to SAFE will become manifest with "the transition of naive users to 
experienced ones," and that new requirements will emerge from experienced 
usage. We have already seen evidence of this in NFAC's use of Interim. 
SAFE. Flexibility in function and performance is a basic requirement in 
the SAFE design and is being monitored by ODP's CSPO. Such changes will 
occur even under the new pilot SAFE proposed by STAP. Change is inherent 
in anv ADP system once users become acquainted with 'its power and begin 
clamoring for changes. In the past 13 years the OCR AEGIS system £ ir st 
built in 1967 has undergone massive changes to adapt to user satistaction 

and dissatisfaction. 
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STATINTL 


STATINTL 


6. The STAP options paper also overlooks: 

(a) The impact on NFAC analysts who have been told that a 
SAFE that they requested and participated in defining over the past 
six years is no longer valid. It is difficult to see how their 
enthusiasm is going to be "built up" for another series of pilot 
experimentations and data gathering; 

(b) The i mpact on the current SAFE development organization 

within OCR, which is just beginning to "jell;" 

(c) The impact on future funding from 0MB and Congress 

not only for an "expanded" Interim but also for a much larger and 
expensive Community SAFE somewhere in the future; 

(d) DIA involvement and funding to date in the Project and 
its long term plans within DoD involving SAFE; 

(e) The critical requirement of making SAFE functions available 
to a suitable number of NFAC analysts in the near term; 

(f) The proposal that CIA made over a year ago to the Community 
for on-line access to its current RECON data base. This will 
provide Community experience sooner than the proposed pilot. The 
RECON data base is the equivalent to the central public file within 
the SAFE system. It is this large central file that would be the 
major Community resource. 

7. In our opinion, the STAP option to change SAFE strategies is 

extremely unwise. The option does not offer a solution that will not 
also contain many of the problems that we now face in the current SAFE 
system design and a new pilot system will most likely surface more 
requirements but not all the requirements that experienced users generate 
against a sy stem once it i s fully operational. Any major revision of 
the existing will waste large amounts of the funding 

already expended. Finally, the approach recommended by STAP was much 
like the original development plan for SAFE, but it was discarded by 
senior Agency managers in favor of the current approach. 

STATINTL 
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